AZL-107739

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-107739.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-107739

Upstream

CVE-2026-92542

Published

2026-10-07T17:17:02Z

Modified

2026-10-12T05:37:42Z

Summary

CVE-2026-92542 affecting package moby-engine 25.0.3-20

Details

The firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams sent from the kernel and forged datagrams sent by user processes. Any packet sent from the host network namespace of a Linux Swarm node is encrypted with the overlay-network IPsec parameters which meets the following criteria:

UDP datagram
Destination port is the Swarm data-path port
Datagram starts with a VXLAN header for the VNI of an encrypted overlay network which any running container on the node is connected to

References

https://nvd.nist.gov/vuln/detail/CVE-2026-92542

Affected packages

Azure Linux:3 / moby-engine

Package

Name: moby-engine
Purl: pkg:rpm/azure-linux/moby-engine

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

25.0.3-20

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-107739.json"